What’s Vulnerable › Vulnerabilities

CVE-2025-53817: GHSL-2025-059 - 7-Zip - Null pointer array write attempt in NArchive::NCom::CHandler::GetStream

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-07-17 · updated 2026-06-17
• Weakness: CWE-476

Description

7-Zip is a file archiver with a high compression ratio. 7-Zip supports extracting from Compound Documents. Prior to version 25.0.0, a null pointer dereference in the Compound handler may lead to denial of service. Version 25.0.0 contains a fix cor the issue.

Affected products

• 7-Zip: before 25.00 — fixed in 25.00

How to fix

Upgrade to a fixed version: 7-Zip 25.00. Check the vendor advisory for mitigations.

References

• https://securitylab.github.com/advisories/GHSL-2025-059_7-Zip/
• https://www.openwall.com/lists/oss-security/2025/07/18/2
• http://www.openwall.com/lists/oss-security/2025/07/18/2

Get alerted when CVE-2025-53817 or the next vulnerability affects your stack